Security Research & Emulation

MWEMU

Windows malware emulator for automated analysis. Emulates x86/x64 user-mode binaries and shellcode without executing them on a real system, designed for fast, scriptable reverse engineering.

kohunt

Drives real Linux .ko drivers inside mwemu's kernel mode and pulls use-after-free, double-free and slab-out-of-bounds findings out of a poisoned, quarantining slab. Found a real one in-tree.

kohunt probe your-driver.ko   # capture the real .probe + fault-inject its allocs
kohunt init  /lib/modules/$(uname -r)/kernel   # sweep every module on the box

PyNasm

A transpiler that converts Python into assembly — a practical tool for writing and studying shellcode.

Earthquakes Monitor

A real-time seismic monitor pulling live USGS feeds: interactive chart, map and event feed, filterable by time window (up to a year) and minimum magnitude.

Noise Hunter

A side project on pressure waves: tooling to study and characterize ambient sound.

mwemu clone running processes

Ptrace-attaching a live Linux process, copying its registers and memory, and handing mwemu a real Emu at the exact point it was frozen — no gdb, no minidump. It resumes and replays real syscalls faithfully against a plain sleep and a live Telegram Desktop, until GPU memory, kernel-injected pages, and a clock that refuses to advance reveal exactly where a mid-flight clone stops being able to keep up.

A beacon, a scan, and one byte of stack

Pointing the mwemu kernel-mode rig at a real, unmodified in-tree driver — drivers/staging/rtl8723bs. A WPS attribute that lies about its length turns a nearby beacon into a write past a one-byte stack variable, on the ordinary Wi-Fi scan path. What emulation surfaces early, and where a human with the hardware takes over. Reported upstream with a fix.

A kernel without a kernel — catching a driver use-after-free

Loading a Linux .ko into mwemu — no real kernel, no root — and driving its ioctls until a deliberate use-after-free turns into a report. A synthetic linker for relocatable driver objects, an interceptable kernel surface, and a slab that quarantines freed chunks so a stale pointer becomes a finding instead of a crash. Worked end to end on a vulnerable telemetry driver.

Scales — carving an embedded eBPF rootkit

Scales: an eBPF-based infostealer & rootkit targeting Arch Linux. Statically pulling the kernel-side eBPF program (scales.bpf.c) out of the deps loader (Atomic Arch AUR campaign) — no execution, no kernel, no root — driven with the mwemu and radare2 MCP servers. With IOCs.